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Schools generate and maintain numerous student records, including grades, standardized test Legislative Attorney 
scores, disciplinary accounts, contact information, mental health records, and more. The Family 

Educational Rights and Privacy Act (FERPA), which applies to educational agencies and 

institutions that receive certain types of financial as sistance fromthe Department of Education 

(ED), regulates the handling of education records in several ways. The law sets forth two key 

requirements for covered entities. First, FERPA requires schools to allow parents to access and review their children’s 
education records. Second, it prohibits schools fromreleasing students’ education records, including personally identifiable 
information (PI), without the written consent of their parents, subject to several exceptions. FERPA defines “education 
records” as materials that (1) “contain information directly related toa student’ and (2) “are maintained by an educational 
agency or institution or by a person acting for such agency or institution.” 


FERPA does not govern all materials that may contain information about a student. The statute exempts certain categories of 
information from its definition of “education records” altogether. For instance, FERPA’s requirements do not apply to 
records independently generated bya school’s law enforcementunit for law enforcementpurposes. 


The statute’s prohibition against disclosing education records also does notapply to so-called “directory information,” as 
long as schools follow specific procedures when doing so. And under ED regulations, schools may disclose “de-identified” 
records without consent. 


FERPA also has various specific exceptions that permit disclosure of student records in different situations. In certain 
circumstances, disclosure of education records absent consent is permitted to appropriate “school officials ,” which can 
include online educational services, law enforcement units, and threat assessment teams. Schools can also disclose a student’s 
records to appropriate parties in emergency situations if necessary to protectthe health and safety of students. In addition, 
schools may disclose education records without consent forthe purpose of certain studies, as wellas for audits and 
evaluations. Disclosure is also sometimes permitted to a state law juvenile justice s ystemin order for that systemto serve the 
student effectively. In eachof these situations, FERPA imposes requirements on the recipients of these student records, 
including how materials may be used and when thoserecords may be re-disclosed. 


Because FERPA does not create a privateright of action to sue schools for noncompliance, enforcementof the statute is 
primarily conducted by ED’s Student Privacy Policy Office, which can review and in vestigate violations. When 
noncomplianceis not resolved through the administrative process, ED can withhold federal funds or terminate eligibility to 
receive federal funds. 


In addition to complying with FERPA’s requirements concerning disclosure of student records, schools that receive federal 
financial assistance mustalso abide by the requirements of Title IX of the Education Amendments of 1972. In May 2020, 
regulations were issued under Title IX that prescribe how schools must respond to allegations of sexual harassmentat school. 
Those regulations require that during a grievance process in response to a formal complaint of harassment, schools must 
make certain information available to relevant parties. Although FERPA does not have an express “exception” for disclosures 
in Title IX sexual harassment proceedings, these requirements may nonetheless be reconcilable. 


Congressional Research Service 


The Family Educational Rights and Privacy Act (FERPA): Legal Issues 


Contents 
What Counts as an Education Record? ............ececsseeececneecceceeeeceeueeccecaaeeeceeeeeceeauaeeeeaeeceeaauees 2 
Accessing Education Records ..............ccsseccneeeeceeceeceeeeeccecaaeeeceeeeeceeaaueeeeceeeceeauaeeeeeaeeeeeeauees 5 
Disclosme: Education ReCords si iic.issse0sceyuetsvines daaseocseensessnd ved eedvsssesvadendeoseg cay bea les Dessegtuedeatadute 5 
Directory Information and De-identified Data ..............ccccesseeeceeceeeeeeeeeceeeeeueaeeeeeeeeeaaaeeees 6 
School Offic tals: EXCepuo Mie. cosceadendcoceacescenechvenerscisescntsebecbsntentnnsecnsesserplayenseasanpiagenswanes 7 
Online Educational Services ................cccssseeeceeseesececeesceeeaesecceeeescnsaesceeceesceseneseeeeoers 7 
Law: Entore em nt i102. cateasesscetnavgarhasesteaensatenes osnaneneiwesceauedpgiueroadneesesnadbanntensansenanurs 8 
Threat-Assessmient Teams... scscs occiedecesscensinetnedinieessedsesscaacsaciacsseheceag bee hecneenauseenceneenses 9 
Health and Safety Emergency Exception..............cccsseeeceeeeeceeeeeeceeaeeceeeaaeeeeeeeeeceeaaaeeeees 10 
Studies and Audits Exceptions...............::cccccsseececcccececceseeccceeecensnsseececeesceeneseseeeeeeeeanes 11 
State Law Juvenile Justice System Exception............. cc ceeeeceeseecceceeeceeeueeeecaaeeeceeeeceeaaaees 12 
Victims of Crimes at Postsecondary Institutions ...............ceeceeeeceeneeeceeeeeceeneeeeeeeneeeeeeaes 12 
BERPACEMMORC CMEN bissteyahenssetetasG sel semshatennlinnensstacnauedeene raced eases 2esces tad Sueeeatesteatageacneatieeacs 13 
How Does FERPA Interact With Other Legal Requirements? ......... 0.0... ceceeeceeeeeeeeceeeeeeeeeeeeenes 14 
Military Recruiters ys scsiete ede docals sivssecentiedsncuseracendenenedeedtedsudtedpuawesehsvarvnseusendvarendoocveabase 14 
Title [IX of the Education Amendments Of 1972.00.00... .eeeceeeeeceeenseeeceeeeeeeeeeeeeeeeueeeenaaeeeees 15 
CONC SION i.550028saihe beens scoewan ban dedebenkseuneebiesoanelsnnguolioagesannaesnd tae vadsateadsedsndesssesinnaduuninndesmosion’ 16 
Tables 
Table 1. Materials Excepted by FERPA or its Implementing Regulations from the 
Definition of “Education Records”’..............cccssseececeeecceceeeeceeeeeccecaaeeeceeueceeaaaeceeaeeeeaaaeeeees 3 
Contacts 
AUthOr [nfOrMatiOn iss.0.éi sensed an vdenentsussestasdencnties sas eubacdiobansced sane des sasonaeagansunsergostanaanseveen eens 17 


Congressional Research Service 


The Family Educational Rights and Privacy Act (FERPA): Legal Issues 


chools generate and maintain numerous records that concem their students, including 

grades, standardized test scores, disciplinary accounts, contact information, mental health 

records, and more. Concems about protecting these materials from improper disc losure 
have increased with the rise of technology that is used to store and maintain school records.! And 
the major expansion of third-party software to enable school instruction at home during the 
Coronavirus Disease 2019 (COVID-19) pandemic has increased some observers’ concem about 
the security of students’ information.” 


The Family Educational Rights and Privacy Act (FERPA), which applies to educational agencies 
and institutions? that receive certain types of financial assistance from the Department of 
Education (ED),* regulates the handling of student records in several ways.° The statute has two 
key features. First, it requires schools to allow parents to access and review their children’s 
education records.®° Second, it prohibits schools from releasing students’ education records, 
including personally identifiable information (PII), without the written consent of their parents.’ 
As this report explains, however, this prohibition is not absolute. For instance, FERPA permits the 
limited disclosure of otherwise protected student records in certain situations, including to other 
school officials for legitimate education interests, or when disclosure is necessary to protect 
health and safety in case of an emergency.® In addition, the statute authorizes disclosure of 
students’ so-called “directory information,” subject to several procedural requirements. ? 


' See, e.g., Betsy Morris, Schools Wrestle With Privacy of Digital Data Collected on Students, WALL ST. J. (July 10, 
2019), https://www.wsj.com/articles/one-parent -is-on-a-mission-t o-protect-children-from-digital-mistakes- 
11562762000. 


? See, e.g., Shawn Hubler, Keeping Online Testing Honest? Or an Orwellian Overreach? N.Y. TIMES (May 10, 2020), 
https://www.nytimes.com/2020/05/10/us/online-testin g-cheatin g-universities-coronavirus.html; Anushka Patil & Jonah 
Engel Bromwich, How It Feels When Software Watches You Take Tests, N.Y. TIMES (Sept. 29, 2020), 
https://www.nytimes.com/2020/09/29/sty le/testing-schools-proctorio html. 


3 Educational agencies and institutions includes local educational agencies (LEAs), elementary and secondary schools, 
and postsecondary educational institutions. See DEP’ T OF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER, 
SCHOOL RESOURCE OFFICERS, SCHOOL LAW ENFORCEMENT UNITS, AND THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY 
ACT (FERPA) 6 (2019) [hereinafter LAW ENFORCEMENT UNITS], https://studentprivacy.ed.gov/resources/school- 
resource-officers-school-law-enforcement-units-and-ferpa. For ease of reference, this report refers to the recipient 
educational agencies and institutions subject to FERPA simply as “schools.” 


420U.SC. § 1232g(a)(1)(A). ED administers a number of programs that distribute financial assistance to schools and 
students, including the Elementary and Secondary Education Act, which authorizes aid for elementary and secondary 
schools (often through state and local educational agencies). See Elementary and Secondary Education Act of 1965, 
Pub. L. No. 89-10, 79 Stat. 27 (as amended by Every Student Succeeds Act, Pub. L. No. 114-95, 129 Stat. 1802 
(2015)). AndED also provides financial assistance to colleges and universities, including through grants and loans 
extended to students, as well as direct financial assistance to certain institutions of higher education, under the Higher 
Education Act. See Higher Education Act of 1965, Pub. L. No. 89-329, 79 Stat. 1219 (as amended). For more on the 
Elementary and Secondary Education Act, see CRS Report R45977, The Elementary and Secondary Education Act 
(ESEA), as Amended by the Every Student Succeeds Act (ESSA): A Primer, by Rebecca R. Skinner. For more on the 
Higher Education Act, see CRS Report R43351, The Higher Education Act (HEA): A Primer, by Alexandra Hegji. 


520 U.S.C. § 1232¢. The Protection of Pupil Rights Amendment also has implications for student privacy. Id. § 1232h. 
Among other things, the law prohibits certain surveys of students absent consent, grants parents of students the right to 
inspect potential surveys, andrequires schools to allow parents to opt out of certain activities, including physical 
examinations. Jd. § 1232h(b), (c)(1)(A), and(c)(2). 


620 U.S.C. § 1232g(a)(1)(A). When a student reaches the age of 18 or attends a postsecondary institution, the rights of 
the parent transfer tothe student. /d. § 1232g(d); 34 C.F.R. §§ 99.3,99.5. 


720 U.S.C. § 1232¢9(b)(1). FERPA rights transfer to students once they reach the age of 18 or attenda postsecondary 
institution. Jd. § 1232g(d);34 C.F.R. §§ 99.3, 99.5. 


8 Td. § 1232.g(b)(1)(A)-(K). 
920 U.S.C. § 12329(b)(1). 
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This report discusses FERPA’s provisions and its application to certain areas, including the use of 
online software for at-home student learning. !° It also examines how the statute is enforced,!! and 
discusses FERPA’s interaction with other legal requirements that apply to schools, such as 
regulations under Title [X of the Education Amendments of 1972 (Title IX), which set standards 
for adjudicating allegations of sexual harassment at school. !? 


What Counts as an Education Record? 


FERPA defines “education records” as materials that (1) “contain information directly related to a 
student” and (2) “are maintained by an educational agency or institution or by a person acting for 
such agency or institution.” !3 Certain records are expressly exempted from coverage under this 
definition, including employment records, !4 as well as records created by educational personnel 
that are in the sole possession of the creator (e.g., notes taken by a teacher regarding a 
conversation with a student) that are not accessible to anyone except a substitute. !> 


One of the notable categories of materials excluded from FERPA’s definition of “education 
records” is materials created and maintained by a school’s law enforcement unit for law 
enforcement purposes.!® Importantly, this category only applies to records that are (1) “created by 
a law enforcement unit,” (2) “created for a law enforcement purpose,” and (3) “maintained by” 
the law enforcement unit.!’ The category does not include records maintained by a component of 
the school other than law enforcement. FERPAregulations clarify that the category does not 


‘0 Because FERPA penalizes schools that have a policy or practice of violating its provisions, 20 U.S.C. § 1232g(b)(1), 
some disagreement exists with regard to how the statute should int eract with state open records laws. Mathilda McGee- 
Tubb, Deciphering the Supremacy of Federal Funding Conditions: Why State Open Records Laws Must Yield to 
FERPA, 53 B.C. L. REV. 1045, 1049 (2012). See United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002) 
(affirming a district court decision that granted an injunction brought by the United States against a university from 
releasing records in violation of FERPA). This report only examines the ways in which FERPA directly regulates the 
disclosure of student records. It does not consider the degree to which FERPA, in addition to imposing record-shielding 
requirements on coveredentities as a condition to receiving federal funds, may also havea preemptive effect on 
inconsistent state or local measures. See generally Caledonian-Record Pub. Co. v. Vermont State Colleges, 175 Vt. 
438,441, 833 A.2d 1273, 1275—76(2003) (collecting cases reaching different conclusions on FERPA’s preemptive 
effect and observing that “state and federal courts are sharply divided on this issue.... Some have questioned whether 
the federal law, merely by withholding funds from educational institutions that release education records to anyone 
other than certain enumerated persons, affirmatively prohibits disclosure of student records.”) (internal citations 
omitted). 


"| See infra “FERPA Enforcement.” 

!2 See infra “How Does FERPA Interact With Other Legal Requirements?” 

1392 U.S.C. § 1232g(a)(4)(A). 

'4 1d. 8 1232g(a)(4)(B)(iii); 34 C.F.R. § 99.3. In addition, medical treatment records for students 18 years of age or 

older or in college are not considered education records. But to meet this definition, treatment records must be 
made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or 
paraprofessional acting in his professional or paraprofessional capacity, or assisting in that 
capacity, and which are made, maintained, or used only in connection with the provision of 
treatmentto the student, andare not available to anyone other than persons providing such 
treatment, except that such records can be personally reviewed by a physician or other appropriate 
professional of the student’s choice. 

20 U.S.C. § 1232g(a)(4)(B)(iv) (emphasis added). 

'520 U.S.C. § 1232g(a)(4)(B)(i). See DEP’ T OF EDUCATION, WHAT RECORDS ARE EXEMPTED FROMFERPA? (accessed 

May 11, 2021), https://studentprivacy .ed. gov/faq/what -records-are-exempted-ferpa. 

16 210 U.S.C. § 1232g(a)(4)(B) (ii); 34 C.F.R. § 99.8 (a)(1). 


'734 CER. § 99.8 (b)(1). See Bauer v. Kincaid, 759 F. Supp. 575,590 (W.D. Mo. 1991). 
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include records, even if created and maintained by the law enforcement unit, that are used 
exclusively for non-law enforcement purposes, such as a disciplinary proceeding. !® But, ifa 
school’s law enforcement unit independently generates an investigative report on a student for 
law enforcement purposes and maintains those records itself, FERPA does not prohibit the local 
law enforcement unit from disclosing that information.!° Because of this distinction, ED advises 
that local law enforcement units maintain law enforcement records separately from education 
records.”° 


In addition to these exclusions, FERPAand its implementing regulations include a number of 
other categories of materials that do not qualify as “education records.”! Table 1 lists materials 
exempted from the definition of “education records.” 


Table |. Materials Excepted by FERPA or its Implementing Regulations from the 
Definition of “Education Records” 


. 3 P “ F ; : 
Instructional Records in Sole Possession of the records of instructional, supervisory, and 
Maker administrative personnel and educational personnel 


ancillary thereto which are in thesole possession of the 
maker thereof and which are not accessible or revealed 
to any other person except a substitute” (20 U.S.C. § 


1232g(a)(4)(B)(i)) 


Law Enforcement Records “records maintained by alaw enforcement unit of 
the educational agency or institution that were created 
by that law enforcement unit for the purpose of law 
enforcement” (20 U.S.C. § 1232g(a)(4)(B) (ii) 


Employee Records “in the case of persons who are employed by 
an educationalagency or institution but who are not in 
attendanceat such agency or institution, records made 
and maintained in the normal course of business which 
relate exclusively to such person in that person’s 
capacity as an employee and are not available for use 
for any other purpose” (20 US.C. § 1232g(a)(4)(B) (iii) 


'8 34 CER. § 99.8 (b)(2). 
'° L Aw ENFORCEMENT UNITS, supra note 3, at 15. 


20 Td. 


2! FERPA regulations contain two such exceptions that are not explicitly mentioned in the statute. The first is for 
records of a former student not directly related to the individual’s attendance asa student. 34 C.F.R. § 99.3. ED states 
that this provision simply clarifies that such materials do not qualify as “education records” under FERPA. Final 
Regulations, Family Educational Rights and Privacy, 73 Fed. Reg. 74806-01, 74811 (Dec. 9, 2008). The secondis for 
student grades from peer-graded papers before recording by the teacher. 34 C.F.R. § 99.3. This regulatory exception 
reflects the Supreme Court’s decision in Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002). See 
also Final Regulations, Family Educational Rights and Privacy, 73 Fed. Reg. 74806-01, 74811 (Dec. 9, 2008). 
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Health Records of Adult Students “records on a student who is eighteen years of age or 
older, or is attending an institution of postsecondary 
education, which are made or maintained by a 
physician, psychiatrist, psychologist, or other 
recognized professional or paraprofessional acting in his 
professional or paraprofessional capacity, or assisting in 
that capacity, and which are made, maintained, or used 
only in connection with the provision of treatment to 
the student, and are not available to anyone other than 
persons providing such treatment, except that such 
records can be personally reviewed bya physician or 
other appropriate professional of the student’s choice” 
(20 US.C. § 1232g(a)(4)(B)(iv)) 


Former Students “Records created or received by an educational agency 
or institution after an individual is no longer a student 
in attendanceand that are not directly related to the 
individual's attendanceas a student” (34 C.F.R. § 99.3) 


Peer Review Grading “Grades on peer-graded papers before they are 
collected and recorded by a teacher” (34 C-F.R. § 99.3) 


Source: CRS. 


A practical example of what counts as an education record under FERPA derives from the 
Supreme Court’s 2002 decision in Owasso Independent School District v. Falvo.2* There, the 
Court considered whether the process of peer grading in classrooms violated FERPA 
requirements.?* The plaintiffs argued that the practice of students grading one another’s papers 
and calling out those grades to the teacher for recording violated FERPA by disclosing students’ 
“education records” without parental consent.** The Court disagreed, ruling that the grades of 
students’ papers, at least before being entered into the teacher’s gradebook, are not “education 
records” because they are not “maintained” within the meaning of the term’s definition.*> The 
term “maintain,” the Court noted, suggested that education records subject to FERPA would be 
“kept in a filing cabinet in a records room at the school or on a permanent secure database.”*° 


22 Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002). 


23 Id, at 428. As explained infra, the Court explicitly did not resolve whether FERPA contains a private right of action 
to bring suit to enforce its provisions in federal court. Jd. at 430-31. The Court later heldthat FERPA did not create a 
private right of action. Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002). 


4 Owasso Indep. Sch. Dist., 534 U.S. at 432. 


25 Id. at 432-33. The Court declined to decide whether FERPA protects grades once they are given to ateacher. See id. 
at 436 (“For these reasons, even assuming a teacher's grade book is an education record, the Court of Appeals erred, for 
in all events the grades on students’ papers would not be covered under FERPA at least until the teacher has collected 
them andrecorded them in his or her grade book. We limit our holding to this narrowpoint, anddo not decide the 
broader question whether the grades on individual student assignments, once they are turned in to teachers, are 
protected by the Act.”). It appears that ED anda few lower courts have concluded that FERPA protects grades ent ered 
into a gradebook. See DEP’ TOF EDUCATION, WHAT IS AN EDUCATION RECORD?, https://student privacy .ed.gov/faq/what - 
education-record (“These records include but are not limitedto grades, transcripts, class lists, student course schedules, 
health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline 
files.”); Greenfield v. Newman Univ., Inc., No. 218CV02655DDCT JJ, 2020 WL 2766172, at *2 (D. Kan. May 28, 
2020) (“FERPA is intendedto protect records” such as “transcripts, test scores, grade information or information 
related to student academic performance.”); Ragusa v. Malverne Union Free Sch. Dist., 549 F. Supp. 2d 288,293 
(E.D.N.Y. 2008) (“[D]ocuments relating to students’ grades, evaluations, and academic performance are undoubtedly 
“education records’ within the meaningof FERPA.”). 


26 Owasso Indep. Sch. Dist., 534 U.S. at 432-33. 
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When students grade one another’s papers, the Court explained, they do not “maintain” records in 
the manner that the school registrar does.” 


Accessing Education Records 


FERPA requires schools that receive financial assistance from ED to allow parents to access and 
review the education records of their children.2® Under the statute, schools must establish 
procedures that facilitate this process, and those procedures must ensure that parents can access 
their children’s records within 45 days of a request.” Parents must also have the option to 
challenge the content of those records in order to ensure their accuracy, including through a 
hearing if requested.*° According to FERPA regulations, schools must annually give parents 
notice of their rights under the law.?! 


Although the rights under FERPA transfer from parents to students when they turn 18 or enter 
postsecondary education,* those students’ right of access to records is limited in several ways. 
For instance, FERPA does not require colleges to make parents’ financial records available to 
students.*? 


Disclosing Education Records 


FERPA prohibits federal funds from going to schools that have a policy permitting disclosure of 
students’ education records, including PII, without written parental consent.** As noted above, the 
definition of “education records” under FERPAis broad, perhaps indicating at first glance that 
schools might be prohibited from ever releasing a broad range of student information. But the 
statute contains numerous qualifications. As explained below, so-called “directory information” 
may be disclosed as long as parents are given prior notice of what materials are designated as 
directory information and an opportunity to opt out. Further, education records may be released to 
specific entities for various purposes outlined in the statute and FERPA regulations. Schools must, 
however, keep a record of which individuals or entities (other than a student’s parents) requested 


27 Td. 


% 20 U.S.C. § 1232g(a)(1)(A). FERPA applies to schools that receive federal financial assistance under an applicable 
program of ED. 


29 Td. § 12329(a)(1)(A). 
30 Td. § 1232g(a)(2); 34 C.F.R. §§ 99.20-99.21 
3134 C.E.R. § 99.7(a). If a school has a policy of disclosing records under the school official exception, the notice must 


also include the criteria used to determine who qualifies as a school official and “what constitutes a legitimate 
educational interest.” Id. § 99.7(a)(3)(ili). See infra “School Officials Exception.” 

20 U.S.C. § 1232g(d); 34 CER. §§ 99.3, 99.5. 

3390 U.S.C. § 1232g(a)(1)(C). The statute provides that the right of access does not extendto letters of 
recommendation in some situations. The statute has different provisions for letters of recommendation from before 
January 1, 1975, andafter. Compare id. § 1232g(a)(1)(C)(ii), with id. § 1232g(a)(1)(C) (iii) (explaining that the right of 
access does not apply to certain confidential recommendations if a student has signed a waiver pursuant to 20 U.S.C. § 
1232g(a)(1)(D)). 

34 Td. § 12329(b). FERPA prohibits disclosing “education records” absent consent ora relevant exception. /d. § 
1232g(b)(1). But the regulations implementing FERPA permit disclosing records without consent if all PII is removed 
“provided that the educational agency or institution or other party has made a reasonable determination thata student's 
identity is not personally identifiable, whether through single or multiple releases, and taking into account other 
reasonably available information.” 34 C.F.R. § 99.31(b)(1). 
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or obtained access to a student’s records, including the legitimate interest such entities had in the 
information. *> 


For many FERPA exceptions,*° the regulations also impose requirements on recipients of student 
records regarding the use and re-disclosure of that information.” When schools disclose PII from 
an education record pursuant to an applicable exception, they must do so on the condition that the 
recipient will not re-disclose the information absent consent.** And when recipients receive 
student information, they may only use the information for the purposes for which it was 
disclosed.*° That said, the regulations provide that schools may disclose PII to a recipient with the 
understanding that the recipient may make further disclosures on behalf of the school if a relevant 
exception applies .*° 


Directory Information and De-identified Data 


Although the prohibition on releasing “education records” broadly encompasses information 
directly related to a student and maintained by a school,*! FERPA nonetheless provides that basic 
student data—so-called “directory information’”—may be released without affirmative consent as 
long as certain requirements are met.*? Directory information includes material that “would not 
generally be considered harmful or an invasion of privacy if disclosed.’*3 Schools must give prior 
public notice of the types of records designated as directory information and an opportunity for 
parents in writing to refuse to allow specific records to be so designated.*+ 


Under FERPA and its implementing regulations, directory information includes a student’s 
identification number,*> as wellas a student’s 


name; address; telephone listing; electronic mail address; photograph; date and place of 
birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, 
full-time or part-time); dates of attendance; participation in officially recognized activities 
and sports; weight and height of members of athletic teams; degrees, honors and awards 
received; and the most recent educational agency or institution attended .“° 


3520 U.S.C. § 1232g(b)(4)(A). This provision appears to exempt disclosures to school officials from this requirement. 
Id. § 1232 g(b)(4)(A); 34 C.F.R. § 99.32(d)(2). 


36 The regulations provide that the use and re-disclosure requirements do “not apply to disclosures under §§ 
99.31(a)(8), (9), (11), (12), (14), (15), and(16), andto information that postsecondary institutions are required to 
disclose under the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act, 20 U.S.C. 
1092(f) (Clery Act), to the accuser andaccused regarding the outcome of any campus disciplinary proceeding brought 
alleging a sexual offense.” 34 C.F.R. § 99.33(c). 


3734 CER. § 99.33. 

38 Td. § 99.33(a)(1). 

39 Td. § 99.33(a)(2). 

40 Td. § 99.33(b). 

4190 U.S.C. § 12329(a)(4)(A). 

4 Td. § 12329(b)(1) and(a)(5)(a). 

B34 CER. § 99.3, 

4 20 U.S.C. § 1232g(a)(5)(a); 34 CER. § 99.37(a)(1)<(3). 


45 A student’s identification number counts as directory information as longas “ the identifier cannot be used to gain 
access to education records except when used in conjunction with one or more factors that authenticate the user's 
identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the 
authorizeduser.” 34 C.F.R. § 99.3. 


46 Td. § 99.3; 20 U.S.C. § 1232g(a)(5)(A). 
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The carve-out of directory information from FERPA’s disclosure prohibition allows schools to 
include certain student information in various publications, such as playbills for theatre 
productions, programs at athletics competitions, student directories, yearbooks, graduation 
programs, and honor rolls.*” Directory information also can be distributed to companies that 
provide class photos, yearbooks, and class rings.*8 


FERPA’s regulations also provide that schools, as well as parties authorized to receive education 
records under a relevant exception (e.g., the exception for audits and evaluations ),4° may disclose 
“de-identified” records absent consent.*° For this exception to apply, the entity must remove all 
PII and make “a reasonable determination that a student’s identity is not personally identifiable, 
whether through single or multiple releases, and taking into account other reasonably available 
information.”>! 


School Officials Exception 


Schools may disclose education records to appropriate “school officials” without parental 
consent.°? School officials include other teachers in the institution if the school has determined 
they have “legitimate educational interests.’°? According to FERPA regulations, outside parties, 
such as contractors, volunteers, or consultants to whoma school has “outsourced institutional 
services or functions,” may also qualify as school officials if (1) the school determines they have 
a legitimate educational interest; (2) they conduct “an institutional service or function for which” 
the school would otherwise use employees; (3) they are “under the direct control” of the school 
regarding the maintenance and use of the records; and (4) they are subject to FERPA’s use and re- 
disclosure requirements .°* 


Finally, schools must “use reasonable methods” to ensure school officials only access those 
records in which they have legitimate educational interests.*> According to guidance from ED, a 
school official will typically have a legitimate educational interest “if he or she needs to review 
an education record in order to fulfill his or her professional responsibilities. ”>° 


Online Educational Services 


While not explicitly set forth in statute or regulations, ED guidance documents interpret the 
school official exception to permit disclosure of education records to third-party providers of 
online educational software.°’ Schools often use online tools to facilitate instruction provided by 


47 DEP’ T OF EDUCATION, STUDENT PRIVACY POLICY OFFICE, THE A-B-C’ S OF STUDENT DIRECTORY INFORMATION (Aug. 
3, 2016), https://studentprivacy ed.gov/trainin g/b-cs-student-directory-information. 


48 Td. 

4 20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35. 
5034 CER. § 99.31(b)(1). 

Sl Id. 


52.20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31. Doe v. Woodford Cty. Bd. of Educ., 213 F.3d921, 927 (6th Cir. 
2000) (“For these reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is 
protected by the [school official and health and safety] exceptions under the Act.”). 


5320 U.S.C. § 1232g(b)(1)(A); 34 C.E.R. § 99.31(a)(1)(i)(A). 
434 CER. § 99.31(a)(1)(i). 

55 Td. § 99.33(a)(ii). 

56 See LAW ENFORCEMENT UNITS, supra note 3, at 11. 


57 DEP’ TOF EDUCATION, STUDENT PRIVACY POLICY OFFICE, FERPA & VIRTUAL LEARNING DURING COVID-19 (Mar. 
2020) [hereinafter FERPA & VIRTUAL LEARNING], 
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third parties. These tools can include programs that students or their parents access through the 
internet to participate in a school activity. The use of such tools has expanded with the increase in 
at-home learning due to the COVID-19 pandemic.>* 


Schools may disclose education records to third-party providers under the school official 
exception as long as the requirements discussed above are met.°? ED has noted that the “direct 
control” requirement above can be met through a contract signed by the school and online 
software provider; in some cases, the “Terms of Service” may satisfy this obligation as well.®° As 
mentioned above, providers that receive education records under the school official exception 
may only use those records for the specific purpose for which they were disclosed.°®! In other 
words, providers may only use those education records to perform the outsourced function 
assigned by the school. This requirement generally precludes providers from selling such 
information to another party or reusing it for another purpose. °* 


Under FERPA’s regulations, however, providers may disclose without consent records that are 
properly “de-identified,” or stripped of all PII.°? According to guidance from ED, this includes 
metadata that the provider collects through its software.® For instance, providers might collect 
information about how long it takes students to perform a discrete task. °° As long as such 
information is stripped of PII, providers may disclose that information without consent. °° 


Law Enforcement 


If aschool has outsourced the duties of providing safety and security to law enforcement unit 
(LEV) officials, such as school resource officers, it may consider them to be “school officials” 
when certain requirements are met.°’ As noted above, records created and maintained by an LEU 


https://student privacy.ed. gov/sites/default/files/resource_document/file/FERP AandVirtualLearning. pdf. 


8 Lisa Ward, Data Privacy in the Age of Online Learning, WALL ST. J. (Dec. 8, 2020), 
https://www.wsj.com/articles/data-privacy -in-the-age-of-online-learning- 1 1607457738. 


» See FERPA & VIRTUAL LEARNING, supra note 57. Of course, particular states may have their own privacy laws that 
restrict when information may be disclosed. See, e.g., Conn. Gen. Stat. Ann. §§ 10-234aa—10-234dd. See Connecticut 
Executive Order 2020-7] (authorizing the Commissioner of Education to waive student data privacy requirements “in 
order to provide quality online educational opportunities” during the COVID-19 pandemic), available at 
https://portal.ct.gov/-/media/Office-of-the-Governor/Executive-Orders/Lamont -Executive-Orders/Executive-Order-No- 
TL.pdf. 

6 DEP’ TOF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER, PROTECTING STUDENT PRIVACY WHILE USING 
ONLINE EDUCATIONAL SERVICES: REQUIREMENTS AND BEST PRACTICESat 4 (Feb. 2014) [hereinafter PROTECTING 
STUDENT PRIVACY ], https://tech.ed.gov/wp-content/uploads/20 14/09/Student-Privacy-and-Online-Educational- 
Services-February-2014.pdf. 


6134 CFR. § 99.31(a)(1)(@). 
62 PROTECTING STUDENT PRIVACY, supra note 60, at 5. 


63 34 C.E.R. § 99.31(b)(1). The regulations provide that such de-identified information may be disclosed “provided that 
the educational agency or institution or other party has made areasonable determination that a student’s identity is not 
personally identifiable, whether through single or multiple releases, and taking into account other reasonably available 
information.” Jd. 

64 PROTECTING STUDENT PRIVACY, supra note 60, at 2-3. 

65 Td. at 5. 

Sid.atS, 


67 See LAW ENFORCEMENT UNITS, supra note 3, at 11. According to ED, an LEU official who is aschool or school 
district employee “ generally would be considered a school official to whom the school or district may disclose, without 
consent, education records (or PII contained in those records), if the law enforcement unit official meets the criteria 
specified in the school or district’s annual notification of FERPA rights to parents and eligible students for being a 
“school official’ with a ‘legitimate educational interest’ in the education records.” Id. See 34 C.F.R. § 99.7(a)(3)(iii). 
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for law enforcement purposes are not education records under FERPA. ®8 This means that if a 
school’s LEU independently generates records on a student for law enforcement purposes, it will 
not violate FERPA if it discloses that information without consent. However, a school may not 
disclose a student’s education records to its LEU without consent unless one of FERPA’s 
exceptions is met.°° 


When schools outsource the function of providing safety and security on campus to LEU 
officials, they may sometimes disclose education records without consent to those LEU officials 
under the school official exception.’° In order to do so, the school resource officer or LEU official 
must meet the four requirements laid out in FERPA’s regulations mentioned above.’! That means 
(1) the school must determine that they have a legitimate educational interest in the records; and 
the LEU official must (2) perform an institutional service or function for the school; (3) maintain 
the records under the direct control of the school; and (4) follow FERPA’s use and re-disclosure 
requirements. ’? 


LEU officials to whom a school has outsourced the function of providing safety and security on 
campus can satisfy requirement (2) because ensuring school safety constitutes an “institutional 
service or function.”’? And as mentioned above, a school can satisfy the “legitimate educational 
interest,” requirement (1), if an LEU official needs to review the information to fulfill his job 
responsibilities.’+ For instance, a school might disclose to its LEU the disciplinary record of a 
student who is barred from campus.’> 


Often, a school will enter a memorandum of understanding with its LEU that establishes data 
protection and use requirements in order to satisfy requirement (3).7° Application of requirement 
(4), FERPA’s use and re-disclosure requirements, means that LEUs may only use education 
records for the purpose for which the disclosure was made, such as ensuring school safety. 77 In 
addition, LEUs may not re-disclose covered education records to outside parties, such as a police 
department, unless one of FERPA’s exceptions is satisfied.7® 


Threat Assessment Teams 


Schools may also use the school official exception to disclose education records to threat 
assessment teams. According to guidance documents issued by ED, a threat assessment team may 
“review incidents of threatening behavior by students (current and former), parents, school 
employees, or other individuals,” and based on their expertise provide guidance to a school on 
how to respond to a potential threat.’ It appears that such teams can assist schools to determine 


6 20 U.S.C. § 1232g(a)(4)(B) (ii). 

6 Td. § 1232g(b)(1). 

70 See LAW ENFORCEMENT UNITS, supra note 3, at 11. 
7! See supra note 54. 

234 CER. § 99.31(a)(1)(i). 

73 LAW ENFORCEMENT UNITS, supra note 3, at 12. 
™ Td. at 11. 

7 Td. at 15. 

76 Td. at 12. 

7 Td, 

8 Id. 

79 Td. 
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whether student records should be disclosed under the health or safety emergency exception. ®° 
The members of a threat assessment team can include individuals not employed by a school, such 
as medical and mental health professionals, as well as law enforcement officers.*! 


Members of threat assessment teams are subject to the limitations that apply to all school 
officials. Consequently, the members may only use education records for the purposes for which 
they were disclosed, and they may not re-disclose the records absent a FERPA exception.8? ED 
guidance documents specifically give an example: if a representative from a police department 
serves on a threat assessment team, he or she may not disclose PII from education records 
accessed as a member of the team to their police department (absent an applicable FERPA 
exception). ®3 


Health and Safety Emergency Exception 


FERPA also provides that student records may be released in emergency situations if necessary to 
protect the health and safety of students.** The statute’s regulations spell out in detail how this 
exception operates.’ Schools “may take the totality of the circumstances” in determining if an 
emergency exists.®° If a school determines that there 1s an “articulable and significant threat” to 
the health or safety of a student or other person, it may disclose an education record to any person 
whose knowledge of that information is necessary to protect health and safety.*’ As long as a 
school has a rational basis for this decision, ED will not “substitute its judgment” for that of the 
school.88 


According to ED, examples of a significant and articulable emergency include an impending 
natural disaster, terrorist attacks, campus threats, or the outbreak of an epidemic disease. *° For 
instance, during the COVID-19 pandemic, ED issued guidance explaining that the health and 
safety emergency exception will sometimes authorize disclosure without consent of PII from 
education records to appropriate public health officials to protect public safety. °° State and local 
law enforcement officials, public health officials, medical personnel, and parents might need to 


80 Td. See supra “Health and Safety Emergency Exception.” 

81 Taw ENFORCEMENT UNITS, supra note 3, at 13. 

82 34 CER. § 99.33. 

83 1. Aw ENFORCEMENT UNITS, supra note 3, at 14. 

8490 U.S.C. § 12329(b)(1)(1). Doe v. Woodford Cty. Bd. of Educ., 213 F.3d 921, 927 (6th Cir. 2000) (“‘Forthese 
reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is protected by the [school 
official and health and safety] exceptions under the Act.”). 

8 34 CER. §§ 99.31(a)(10), 99.36. 

86 Td. § 99.36(c). 

87 Td. 

88 Td. See DEP’ T OF EDUCATION, ADDRESSING EMERGENCIES ON CAMPUS 4 (June 2011) [hereinafter EMERGENCY 
GUIDANCE] (“This is a flexible standard under which the Department defers to school administrators so that they may 
bring appropriate resources to bear on the situation, providedthat there is a rational basis for the educational agency’s 


or institution’s decisions about the nature of the emergency and the appropriate parties to whom the information should 
be disclosed.”), https://studentprivacy .ed. gov/sit es/default/files/resource_document/file/emergency -guidance.pdf. 

89 See LAW ENFORCEMENT UNITS, supra note 3, at 17; EMERGENCY GUIDANCE, supra note 88, at 3. 

90 DEP’ TOF EDUCATION, STUDENT PRIVACY POLICY OFFICE, FERPA & CORONA VIRUS DISEASE 2019 (COVID-19), 
FREQUENTLY ASKED QUESTIONS (FAQs) (Mar. 2020), 

https://student privacy.ed. gov/sites/default/files/resource_document/file/FERP A %20and%20Coronavirus%20Fre quent! 
y %20Asked%20Questions_O.pdf. See also CRS Report R46542, Digital Contact Tracing and Data Protection Law, by 
Jonathan M. Gaffney, Eric N. Holmes, and Chris D. Linebaugh. 
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receive records to protect the health and safety of students and others.?! Any time that a school 
discloses a student’s PI from education records under the emergency exception, it must record 
the threat and the parties to whom records were disc losed.?” 


According to guidance from ED, FERPA does not prohibit a school official from disclosing 
information obtained not through a record but from personal knowledge or observation. For 
instance, if a teacher overhears a student make a threat, FERPA does not prohibit that information 
from being disclosed.°* Consequently, the teacher could disclose what he or she overheard to 
appropriate authorities.?° 


Studies and Audits Exceptions 


FERPA also allows disclosing education records for the purpose of certain studies,?° as well as for 
audits and evaluations.°’ The studies exception allows schools to disclose records to organizations 
conducting studies in order to (1) develop, administer, or validate predictive tests; (2) administer 
student aid programs; or (3) improve instruction. °° For instance, a school might disclose 
education records to an organization that compares student outcomes across different school 
districts.°? Disclosures under the studies exception are permitted only if the study does not 
authorize the personal identification of students or parents other than to members of the 
organization with legitimate interests in the information. !°° In addition, when no longer needed 
for the study, the information must be destroyed. !°! Finally, in order to disclose education records 
to an organization under the studies exception, schools must enter into written agreements with 
the organization that specify the scope of the study and limit the use of PII in various ways. !°? 


The audit and evaluation exception permits schools to release education records without consent 
to authorized representatives of state and local educational authorities. !°> Information under the 


°! EMERGENCY GUIDANCE, supra note 88, at 3. 

2 34 C.F.R. § 99.32(a)(5). 

°3 EMERGENCY GUIDANCE, supra note 88, at 4. 

4 Td. According to ED, “this general rule does not apply where a school official personally learns of information about 
a student through his or her official role in making a determination about the student and the determination is 
maintained in an education record.” Id. 

77 id. 

© 20 U.S.C. § 12329(b)(1)(F); 34 C.F.R. § 99.31(a)(6). 

°7 20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 CER. §§ 99.31(a)(3), 99.35. 

8 20 U.S.C. § 12329(b)(1)(F); 34 C.F.R. § 99.31(a)(6)(i). 

°° DEP’ TOF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER, GUIDANCE FOR REASONABLE METHODS AND 
WRITTEN AGREEMENTS 1-2 (June 2015), 

https://student privacy.ed. gov/sites/default /files/resource_document/file/Guidance_for_Reasonable_Methods%20final0O 
.pdf. 

100 34 CER. § 99.31(a)(6)(ii)(A). 

101 Td. § 99,.31(a)(6)(iii)(B). 

102 Td. § 99.31(a)(6)(iii)(C). In particular, the regulations provide that schools enter into a written agreement that “ (1) 
Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed; (2) Requires the 
organization to use personally identifiable information from education records only to meet the purpose or purposes of 
the study as statedin the written agreement; (3) Requires the organization to conduct the study in a manner that does 
not permit personal identification of parents and students, as defined in this part, by anyone other than representatives 
of the organization with legitimate interests; and (4) Requires the organization to destroy all personally identifiable 
information when the information is no longer needed for the purposes for which the study was conducted and specifies 
the time periodin which the information must be destroyed.” 


103 D0 U.S.C. § 1232g(b)(1)(©), (b)(3), (b)(5); 34 C-F.R. §§ 99.31(a)(3), 99.35. Disclosure under this exception may 
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exception must be used to audit or evaluate a federal or state-supported education program or to 
enforce or ensure compliance with federal legal requirements connected to those programs. !°* As 
with the studies exception, schools must enter into written agreements with recipients of the 
information that specify how the information will be used and when it will be destroyed. !° 
Further, written agreements must establish policies and procedures that protect information from 
further disclosure. !°° 


State Law Juvenile Justice System Exception 


FERPA also authorizes disclosing education records to a state or local juvenile justice system 
without consent in certain situations.!°’ If a state has adopted a statute after November 19, 1974, 
that specifically allows disclosure of student education records to state and local officials, then 
disclosure without consent is allowed if the disclosure concerns the juvenile justice system’s 
“ability to effectively serve, prior to adjudication, the student whose records are released.”!°% 
Officials to whom this information is disclosed must certify in writing that they will not re- 
disclose the information except as provided under state law or with consent. !°? Guidance from 
ED, in coordination with the Department of Justice (DOJ), indicates that disclosure under this 
exception is limited to a local or state juvenile justice system agency.!!° For instance, in situations 
where the above conditions are met, if a student is arrested for a crime for the first time, a police 
department’s juvenile division can receive education records from a school about the student in 
order to serve the student effectively prior to adjudication. !!! 


The juvenile justice system exception appears to authorize some disclosures of education records 
by a school district to a local juvenile justice agency, although the outer bounds of when a 
disclosure concerns the juvenile justice system’s ability to serve a student effectively are 
uncertain. Because the statute imposes this requirement for “the student whose records are 
released,” disclosure under this exception may require a specific finding of need for a particular 
student. This reading of the statute seems consistent with ED and DOJ guidance describing how 
the exception operates. !!2 


Victims of Crimes at Postsecondary Institutions 


Postsecondary institutions may disclose certain disciplinary records of an alleged perpetrator of a 
crime of violence or a nonforcible sex offense. !!3 First, institutions may disclose to the alleged 


also be made to the Comptroller General of the United States, the Attorney General, andthe Secretary of Education. 20 
U.S.C. § 1232g(b)(1)(C); 34 C.F.R. § 99.31(a)(3). 


4 20 U.S.C. § 1232g(b)(3), (b)(5)334 CER. § 99.35, 
5 34 CER. § 99.35(a)(3). 

106 Td. § 99.35(a)(3)(v). 

9720 U.S.C. § 12329(b)(1)(E). 


98 Td. § 1232g(b)(1)(E) (ii); 34 C.F.R. § 99.38. The statute has a similar provision for state laws passed before that date. 
20 U.S.C. § 1232g(b)(1)(E)(). 


9 20 U.S.C. § 12329(b)(1)(E)(ii). 

10 See DEP’TOF EDUC., SHARING INFORMATION: A GUIDETO THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND 
PARTICIPATION IN JUVENILE JUSTICE PROGRAMS 8 (1997). 

"1 Td. at 8. 

2 Td. at 8-9. 


'3 20 U.S.C. § 12329(b)(6). Regulations implementing FERPA provide definitions and examples of these terms. 34 
C.F.R. § Appendix A to Part 99. 
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victim of sucha crime the final results of disciplinary proceedings that are conducted against the 
alleged perpetrator of the crime.!!* Second, if an institution determines through a disciplinary 
proceeding that a student violated its rules or policies with respect to a crime of violence or 
nonforcible sex offense, then it may disclose the final results of that proceeding to anyone.!!> The 
final results are limited to the name of the student, the violation committed, and any sanction the 
institution imposes.!!® The names of other students, however, such as other victims or witnesses, 
may only be disclosed with their consent.!!7 


Importantly, while FERPA authorizes postsecondary institutions to disclose the results of 
disciplinary proceedings to the alleged victim of a crime of violence or a nonforcible sex offense, 
a statutory provision outside of FERPA, contained in the Higher Education Act (HEA), requires 
institutions of higher education to do so in certain circumstances.!'!® As a condition of receiving 
funds under Title IV of the HEA, institutions of higher education must enter a Program 
Participation Agreement that requires them to, upon written request, disclose to the alleged victim 
of acrime of violence or a nonforcible sex offense the report on the results ofa disciplinary 
proceeding against the student who 1s the alleged perpetrator of that offense. !!9 


FERPA Enforcement 


As explained above, FERPA prohibits federal funding of schools that have a policy of denying 
parents the right to review the education records of their children, as well as schools that have a 
policy or practice of disclosing student education records to unauthorized entities. !2° The 
enforcement of FERPA’s provisions is statutorily entrusted with the Secretary of Education, who 
is responsible for designating an office and review board for investigating and reviewing 
complaints of violations.!*! The Student Privacy Policy Office in ED reviews and investigates 
complaints and violations of FERPA. !?? Following an investigation, it will provide any 
complainant as well as the school written notice of its findings. '73 In cases where ED finds that a 
school has not complied with FERPA and that failure was based on a school’s policy or practice, 
the notice to the school will include the specific steps needed to comply with FERPA, and provide 
a reasonable time to comply. !*4 If the school does not comply within the time given, the Secretary 
can enforce FERPAin a variety of ways, including by withholding further payments under any 
educational program, issuing a complaint to compel compliance through a cease and desist order, 


4 D0 U.S.C. § 1232g(b)(6)(A). 

'S Td. § 1232g(b)(6)(B). 

16 Td. § 1232g(b)(6)(C). 

'7 Td. § 1232(b)(6)(C) (ii). 

118 Td. § 1094(a)(26). 

'9 Td. § 1094(a)(26). 

20 20 U.S.C. § 1232g(a)(1); (b)(1). 
21 Td. § 1232g(f); (g). 


>? FERPA regulations refer to the Office of the Chief Privacy Officer. 34 C.F.R. § 99.60. The ED website indicates 
that the Student Privacy Policy Office is led by the Chief Privacy Officer. DEP’ TOF EDUCATION, STUDENT PRIVACY 
POLICY OFFICE, https://www2.ed.gov/about/offices/list/opepd/sppo/index.html. 


23 34C.FR. § 99.66(b). 
4 Td. § 99.66(c). 
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or terminating eligibility to receive funding under any educational program. !7> Another option is 
for the DOJ to bring a lawsuit on behalf of the United States against a noncompliant school. !*° 


Aside from the possibility of a lawsuit brought by the DOJ, the administrative scheme 
implemented by ED is the primary enforcement mechanism for FERPA. Whereas some other 
federal requirements for schools, such as Title [X of the Education Amendments of 1972,!7’ are 
enforceable through a private right of action brought in federal court directly against a school for 
violations, FERPA does not create such a private right of action for students or parents. Courts 
have recognized that the statute itself does not explicitly establish a private right of action to sue 
for violations.!?8 And in the 2002 case of Gonzaga University v. Doe, the Supreme Court ruled 
that FERPA also does not create any personal rights enforceable under 42 U.S.C. § 1983 (which 
provides a remedy for violations of federally conferred rights against state officials). !*° According 
to the Court, because Congress did not clearly and unambiguously establish an enforceable right 
in the statute, FERPA could not be enforced via a suit under § 1983. !3° 


How Does FERPA Interact With Other Legal 
Requirements? 


Military Recruiters 


While FERPA generally prohibits schools from disclosing student education records without 
consent unless an exception applies, two other statutes require schools to disclose certain student 
information to military recruiters. The Elementary and Secondary Education Act (ESEA) imposes 
certain requirements on local educational agencies that receive federal funds under its 
provisions.!3! Those schools must disclose the name, address, and telephone listing of secondary 
school students upon request to a military recruiter.!3* Parents may opt out of this disclosure for 
their children, and schools must notify parents of this option. !*? Another statute generally directed 
at the Department of Defense imposes similar requirements, '*4+ but defines covered schools 
somewhat differently. !*> 


25 Id. § 99.67(a). See 34 C.F.R. § 99.60(c) (designating the Office of Administrative Law Judges as the Review Board 
authorizedto enforce the Act). 


6 See e.g., United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002) (affirming a district court decision that 
granted an injunction brought by the United States against a university from releasing records in violation of FERPA). 


2700 U.S.C. § 1681. See Cannon v. Univ. of Chicago, 441 U.S. 677, 717 (1979). 


28 Girardier v. Webster Coll., 563 F.2d 1267, 1276 (8th Cir. 1977); Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002) 
(noting that the lower court “acknowledged that ‘FERPA itself does not give rise to a private cause of action’”). 


°° Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002). 
30 Td. at 290. 


7 Elementary and Secondary Education Act of 1965, Pub. L. No. 89-10, 79 Stat. 27, codified as amended at 20 U.S.C. 
§ 6301 et seq. The Every Student Succeeds Act reauthorizedthe ESEA. See Pub. L. No. 114-95, 129 Stat. 1802 (2015). 


32 20 U.S.C. § 7908(a)(1). 
33 Td. § 7908(a)(2). When a student turns 18, the consent required of parents transfers to the student. Id. § 7908(a)(5). 
34 10 U.S.C. § 503(c)(1). 


35 Id. § 503(c)(6). The DOD-specific statute also applies to local educational agencies that receive assistance under the 
ESEA, but defines local educational agencies as (1) local educational agencies within the meaning of the term under 
the ESEA and (2) private secondary schools. Jd. § 503(c)(6). By contrast, the ESEA defines local educational agencies 
as primarily “public” entities. 20 U.S.C. § 7801(30)(A). 
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Title IX of the Education Amendments of 1972 


In addition to complying with FERPA’s requirements concerning disclosure of student records, 
schools that receive federal financial assistance must also abide by the requirements of Title [X of 
the Education Amendments of 1972.!3° That statute generally prohibits schools from 
discriminating on the basis of sex.!3” In May 2020, ED issued regulations under Title IX that 
prescribe how schools must respond to allegations of sexual harassment at school. !38 Those 
regulations require that, during a grievance process in response to a formal complaint of 
harassment, schools must provide both parties the opportunity to review any evidence obtained 
through an investigation related to the allegations. !*° They also require schools to allow parties to 
have an advisor present during any proceeding of the grievance process. !4° Schools must create an 
investigative report that is sent to each party and their advisor, '*! and issue written determinations 
of responsibility that include various findings that are disclosed to the parties. '4? 


Schools that receive federal financial assistance generally must comply both with FERPA and 
these Title [X requirements. Although FERPA does not have an express “exception” for 
disclosures in Title [X sexual harassment proceedings, these requirements may nonetheless be 
reconcilable. According to ED, the requirements of FERPA and the Title [X regulations do not 
contradict each other. !43 But in cases in which a direct conflict arises, ED asserts, Title [X’s 
requirements override FERPA.!*4 For support, ED points to the larger General Education 
Provisions Act (GEPA)—of which FERPAis a part—which provides that nothing in its 


136 90 U.S.C. § 1681. 


'37 Td. § 1681. While ED’s Student Privacy Office enforces FERPA, Title IX’s requirements for educational programs 
receiving federal financial assistance from ED are enforced by the Office for Civil Rights. See DEP’ TOF EDUCATION, 
ABOUT OCR (last accessed Feb. 24, 2021), https://www2.ed.gov/about/offices/list/ocr/aboutocr.html. 


!38 Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance, 
85 Fed. Reg. 30026 (May 19, 2020) (codified at 34 C.F.R. Part 106) [hereinafter Nondiscrimination]. These provisions 
are similar to those included in regulations implementing the Clery Act. 34 C.F.R. § 668.46(k). The Clery Act 
provisions apply to institutions of higher education who participate in Title 1Vof the Higher Education Act’s student 
financial assistance programs. CRS In Focus IF11277, The Clery Act: Requirements and Legal Issues, by Jared P. Cole. 
The procedural requirements for disciplinary actions cover cases of alleged dating violence, domestic violence, sexual 
assault, and stalking. 34 C.F.R. § 668.46(k). The Clery Act regulations also provide that compliance with those 
requirements does not violate FERPA. /d. § 668.46(1). 

'39 34 CER. § 106.45(b)(5)(vi). 

'40 Td. § 106.45(b)(5)(iv). 

‘417d. § 106.45(b)(5)(vii). 

'42 Td. § 106.45(b)(7). The Biden Administration issued an executive order directing ED to review these regulations for 
consistency with Title 1X and the Administration’s position that the statute’s bar against sex discrimination includes 
sexual orientation and gender identity. Exec. Order 14021, 86 Fed. Reg. 13,803 (Mar. 11, 2021). ED’s Office of Civil 
Rights (OCR) has since announced that it is conducting a review of existing regulations, including amendments to the 
regulations made in 2020, in light of the executive order. OCR also indicated that after a period of review and hearing 
from the public, it anticipates issuing a notice of proposed rulemaking to amend the Title IX regulations. Suzanne B. 
Goldberg, Acting Assistant Secretary for Civil Rights, Letter to Students, Educators, and other Stakeholders re 
Executive Order 14021 (Apr. 6, 2021), 

https://www2.ed.gov/about/offices/list/ocr/correspondence/st akeholders/202 10406 -titleix-eo- 14021 .pdf. 

'43 Nondiscrimination, supra note 138, at 30426, 30428 (“The Department disagrees that § 106.45(b)(5)(v) [of Title Ix- 
implementing regulations] inherently or directly conflicts with FERPA. A recipient should interpret Title IX and 
FERPA ina manner to avoidany conflicts.”). 


'44 Td.at 30426 (“To the extent that there may be unusual circumstances, where a true conflict bet ween Title IX and 
FERPA may exist (such as a student’s formal complaint against an employee), the Department includes a provision in § 
106.6(e) to expressly state that the obligation to comply with these final regulations under Title IX is not obviated or 
alleviated by the FERPA statute or regulations.”). 
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provisions “shall be construed to affect the applicability of” Title [X.!4° And the Title IX 
regulations themselves provide that a recipient’s obligation to comply with Title [X’s 
requirements “‘is not obviated or alleviated by the FERPA.”!4¢ 


Further, ED asserts that these Title [X regulations help protect a party’s right to procedural due 
process under the Constitution. '*7 In certain student disciplinary cases involving public schools, 
the Constitution requires that parties be given adequate notice of the charges against them and a 
meaningful opportunity to respond.'*8 ED is precluded from enforcing Title IX or FERPA in a 
manner that deprives students of their constitutional rights. '4° According to this line of reasoning, 
FERPA cannot prohibit a school from disclosing to an accused student the evidence collected 
against him or her in a disciplinary proceeding because that would violate due process.!>° 


In addition, ED points to the FERPA requirement that parents (or eligible students) have access to 
their own education records. !°! FERPA’s definition of education records includes records that 
“contain information directly related to a student.”!>? ED notes that the evidence and investigative 
report disclosed pursuant to Title [X regulations directly relates to the allegations in a complaint, 
and therefore “directly relate” to the students at issue. !°? 


Moreover, as a practical matter, even if compliance with certain Title [X requirements might 
appear to conflict with FERPA’s provisions in a particular situation, schools that comply with 
Title [X regulations by disclosing evidence to parties in a disciplinary proceeding are unlikely to 
face legal repercussions. As noted above, FERPA does not create a private right of action, 
meaning that ED conducts most enforcement of the statute. '*+ But here, ED has explicitly 
acknowledged that, as it administers both FERPA and Title IX, it will “not interpret compliance 
with its regulations under Title IX to violate requirements in its regulations under FERPA.”!>° 


Conclusion 


Although FERPA’s prohibition on disclosing student records without consent is framed broadly, 
the various exceptions to that mandate have provided schools flexibility to respond to situations 
in which certain information merits release. As discussed above, schools may disclose materials 
in order to ensure school safety, to participate in certain studies aimed at improving education 
outcomes, and to adapt to changes in how education is generally offered, including through 
developments in technology. 


4 20 U.S.C. § 1221(d). 
46 34 CFR. § 106.6(e). 
47 Nondiscrimination, supra note 138, at 30421. 


48 See Doe v. Purdue Univ., 928 F.3d652, 656 (7th Cir. 2019) (Barrett, J.); Doe v. Miami Univ., 882 F.3d579, 603 
(6th Cir. 2018). 
49 Nondiscrimination, supra note 138, at 30422. 


50 While due process requirements generally apply to public entities, such as a state school, ED has applied its 
reasoning to recipient private schools as well. Id. at 30421-22. 


5! Jd. at 30433. See 20 U.S.C. § 1232g(a)(1). 
90 U.S.C. § 1232g(a)(4)(B). 

53 Nondiscrimination, supra note 138, at 30433. 
4 See supra “FERPA Enforcement.” 

55 Nondiscrimination, supra note 138, at 30433. 
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Some have expressed larger concerns with the handling of student records .!5° The maintenance 
and use of student records by third parties authorized to receive them for a particular purpose, for 
instance, can generate controversy. !>’ If lawmakers believe these concerns are warranted, they can 
address them through legislation that amends FERPA to define schools’ and other parties’ 
obligations more specifically. Further, because the statute lacks a private right of action for 
students or parents to bring suit in response to FERPA violations, Congress could consider adding 
such aright to the statute. Finally, Congress could also amend the law to clarify the relationship 
between FERPA and a school’s obligations under Title IX. 
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156 See, e.g., Kathleen McGrory & Natalie Weber, Feds Investigating Pasco Schools Giving Student Data to Sheriff, 
TAMPA BAY TMES (Apr. 19, 2021) (observing that ED “has openedan investigation into whether the Pasco school 
district broke federal law by sharing private student information with the Pasco Sheriff's office”), 
https://www.tampabay.com/investigations/202 1/04/19/feds-invest igating-pasco-schools-giving-student-data-to-sheriff/. 


'57 See, e.g., Lisa Ward, Data Privacy in the Age of Online Learning, WALL St. J. (Dec. 8, 2020) (“Schoolsare relying 
heavily on technology—from videoconferencing programs to digital-teaching tools andtemperature-taking apps—to 
educate children safely in the age of Covid. But this rapid deployment of new technology means schools are collecting 
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